You have an Azure virtual machine named VM1 that runs Windows Server.

The three requirements together describe just-in-time (JIT) VM access: administrators must request approval before an RDP connection is allowed, and once granted, access is restricted to specific source IP addresses and to a specific management port. JIT VM access is a capability of Microsoft Defender for Cloud (under the Defender for Servers plan); it dynamically locks down inbound rules on the VM ' s network security group and only opens the specified port, for the specified source IP addresses, for a limited time after an access request is approved. A network security group alone can restrict traffic by port and source IP, but it has no request-and-approval workflow or automatic time-limited opening/closing behavior — it only enforces whatever rules are already statically configured; it is really the mechanism JIT manipulates, not the solution that provides the request-approval layer. Microsoft Entra Privileged Identity Management manages time-bound elevation for Entra ID and Azure RBAC roles, not network-level port access. Azure Front Door is a global HTTP/HTTPS load balancer and application delivery service, unrelated to RDP access control. Microsoft Defender for Cloud is therefore the correct configuration target.